Panda Software reports on the new Netsky.C worm

PandaLabs has detected the appearance of the new C variant of the Netsky worm (W32/Netsky.C.worm). This malicious code is very similar to its predecessor, Netsky.B, which is still causing a large number of incidents worldwide. In fact, Netsky.B has been the virus most frequently detected by the free online antivirus Panda ActiveScan over the last few days.

Netsky.C reaches computers in an e-mail message whose subject, message body and attached file are selected at random from a long list of options.

When the attached file is run, Netsky.C copies itself to all the disk drives on the computer under the name WINLOGON.EXE.

It spreads by sending itself out to all the e-mail address it finds in files with the extensions .eml, .txt, .php, .pl, .htm, .html, .vbs, .rtf, .uin, .asp, .wab, .doc, .adb, .tbb, .dbx, .sht, .oft, .msg, .shtm, .cgi, and .dhtm stored on the computer. It does this using its own SMTP engine.

The worm also copies itself under a wide range of names to all the folders on the computer whose name contains the sequence of letters ‘shar’. By doing this, it can also spread through P2P file sharing applications like KaZaA.

Netsky.C has been designed to emit a specific sequence of sounds through the speakers of the affected computer between 06:00 a.m. and 08:59 a.m. on February 26.

Finally, this worm inserts several entries in the Windows Registry in order to ensure that it is run whenever the infected computer is started up. Similarly, it deletes any entries that may have been created by other malicious code such as Mydoom.A and Mimail.T